boundgraph_check/
lib.rs

1//! Layer 5 of BoundGraph: the checkers, and the signatures that make them evidence.
2//!
3//! This is where Law III is cashed in. A reasoner proposes; a tool acts; a
4//! slicer condenses. None of that is allowed to commit anything. A state change
5//! commits only on [`Evidence`] — a verdict from a model-free checker, signed,
6//! naming exactly what it looked at.
7//!
8//! # The two guarantees, and where they live
9//!
10//! **Model-free.** [`Checker::check`] refuses to run a checker whose declared
11//! capability set is not within [`checker_ceiling`], which omits `net` and
12//! `secret`. A checker therefore cannot reach an inference API — not by
13//! convention, by authority. The same ceiling omits `time` and `rand`, which is
14//! what makes the determinism requirement enforceable rather than aspirational.
15//!
16//! **Unforgeable.** [`Checker::check`] puts the digests of the work order and
17//! the condensate into the evidence itself and then signs the whole thing, so a
18//! passing verdict cannot be harvested and reattached to a patch that failed.
19//! Both steps are in the trait's provided method, so no implementation can skip
20//! either.
21//!
22//! # Status
23//!
24//! Feature 08, milestone M3. Built in dependency order rather than story order:
25//! signing has no dependency on the trait, and `check` returns signed evidence,
26//! so signing comes first.
27//!
28//! | Story | Module |
29//! |---|---|
30//! | US-0802 evidence signing | [`sign`] |
31//! | US-0801 checker trait | [`checker`] |
32//! | US-0803 JSON Schema checker | [`schema`] |
33//! | US-0804 compile checker | [`sandbox`], [`compile`] |
34//! | US-0805 test-run checker | [`testrun`] |
35//! | US-0806 diff-scope checker | [`scope`] |
36//!
37//! [`Evidence`]: boundgraph_core::Evidence
38
39#![doc(html_root_url = "https://docs.rs/boundgraph-check")]
40
41pub mod checker;
42pub mod compile;
43pub mod sandbox;
44pub mod schema;
45pub mod scope;
46pub mod sign;
47pub mod testrun;
48
49pub use checker::{CheckError, Checker, Constant, Judgement, checker_ceiling, ensure_model_free};
50pub use compile::{CompileChecker, CompileConfig, ProbeError, SandboxedCompile};
51pub use sandbox::{Command, Outcome, Sandbox, SandboxError, workspace_grant};
52pub use scope::{Change, ChangeKind, DiffScope, PatchError, parse_patch};
53pub use testrun::{SandboxedTests, TestConfig, failing_tests};
54
55#[cfg(feature = "unconfined")]
56pub use sandbox::Unconfined;
57pub use schema::{
58    DEFAULT_BUDGET, MAX_DEPTH, SUPPORTED_KEYWORDS, Schema, SchemaChecker, SchemaError, Validation,
59    Violation,
60};
61pub use sign::{
62    KeyRing, LocalKey, PUBLIC_KEY_LEN, PublicKey, SEED_LEN, Sign, SignError, VerifyError,
63    sign_evidence, verify,
64};
65
66/// Re-exported so a consumer holding evidence does not also depend on
67/// `boundgraph-core` just for the types it is made of.
68pub use boundgraph_core::{CheckerId, Evidence, EvidenceKind, Signature, SigningKeyId, Verdict};
boundgraph_check/lib.rs

boundgraph_check/
lib.rs
